Phishing

The Attacks → Phishing tab is where you create and track phishing campaigns against in-scope users. This guide walks you through opening the tab and starting a campaign.

Open Phishing

1. Go to Attacks → Phishing.

Praetorian operators: the Target OSINT sub-tab enumerates people and probes account-existence oracles. See Target OSINT.

Campaigns table

The table lists campaigns with status, targets, and last activity. Use Filters to narrow by status or owner.

Start a campaign

1. Click New (or the primary create action on the tab).
2. Follow the campaign wizard: audience, sending domain, template, and schedule.
3. Sending domains come from Domain Parking. Check out a domain there if none are available.
4. Save. The campaign appears in the table; open a row to see results.

Campaign results and evilginx captures

Open a campaign row for per-recipient results. When the campaign uses evilginx (AiTM), Guard ingests captured credentials and session cookies over an authenticated webhook and attributes them to the targeted user. You do not SSH into phishkit nodes to collect loot.

Guard configures evilginx webhook notifiers during Configure and Reconfigure. Operators get capture notifications without running evilginx notify by hand.

Raw session cookies are not in the campaign list. Full loot (credentials, cookies, user agent, origin IP, timestamps) is on the capture detail record.

Programmatic access:

GET /red-team/campaigns/{id}/captures
GET /red-team/captures/{uuid}

The list returns metadata and capture UUIDs. The detail endpoint returns the full session. Contact your Praetorian engagement team to register evilginx node IPs on the Guard WAF allowlist and issue webhook bearer tokens before a simulation.

Support

If you cannot send or a domain is missing, reach out to support@praetorian.com.